German Regional Court to Revisit Ruling in Injunction Proceedings on Request to Preserve WHOIS data

[Rafik Dammak]

Hi all,

I shared few days ago an announcement from ICANN regarding ICANN appealling
the decision by a German court on the injunction against a German registrar
refusing to collect some data for whois. ICANN just published another
update today regarding the German Regional Court’s decision to revisit a
ruling in the injunction proceedings.

We may expect that this judicial saga will continue for a while and by
ICANN statement itself it can go to a high level. As you may have seen in
as reactions the list, all these rise questions about ICANN strategy as
organization on this issue.

Best Regards,

Rafik

https://www.icann.org/news/announcement-3-2018-06-21-en
------------------------------------------------------------------------------------------------
German Regional Court to Revisit Ruling in Injunction Proceedings on
Request to Preserve WHOIS data
<https://www.icann.org/news/announcement-3-2018-06-21-en#>
<https://www.icann.org/news/announcement-3-2018-06-21-en#>
<https://www.icann.org/news/announcement-3-2018-06-21-en#>
<https://www.icann.org/news/announcement-3-2018-06-21-en#>
<https://www.icann.org/news/announcement-3-2018-06-21-en#>
<https://www.icann.org/news/announcement-3-2018-06-21-en#>

LOS ANGELES – 21 June 2018 – The Internet Corporation for Assigned Names
and Numbers (ICANN) was informed today that the Regional Court in Bonn,
Germany, has decided to revisit its ruling in the injunction proceedings
that ICANN initiated
<https://www.icann.org/news/announcement-2018-05-25-en> against
EPAG, a Germany-based, ICANN-accredited registrar that is part of the
Tucows Group.

On 13 June 2018, ICANN appealed the Regional Court's initial decision to
reject ICANN's application for an injunction, in which ICANN sought a court
order requiring EPAG to reinstate collection of administrative and
technical contact data for new domain name registrations.

Upon receipt of an appeal, the Regional Court has the option to re-evaluate
its decision that is being appealed, or affirm its decision and immediately
forward the matter to the Higher Regional Court for consideration of the
appeal.

In this instance, the Regional Court has decided to revisit its initial
decision and has asked EPAG to comment on ICANN's appellate papers within
two weeks.

ICANN is pursuing this matter as part of its public interest role in
coordinating a decentralized global WHOIS for the generic top-level domain
system. To that end, ICANNcontinues to seek clarity of how to maintain a
global WHOIS system and still remain consistent with legal requirements
under the European Union's General Data Protection Regulation (GDPR).
Background:

On 25 May 2018, ICANN filed the injunction proceedings against EPAG.
ICANN asked
the Court for assistance in interpreting the GDPR in an effort to protect
the data collected in WHOIS. ICANN sought a court ruling to ensure the
continued collection of all WHOIS data. The intent was to assure that all
such data remains available to parties that demonstrate a legitimate
purpose to access it, and to seek clarification that under the GDPR, ICANN may
continue to require such collection.

ICANN filed the proceedings because EPAG had informed ICANN that as of 25
May 2018, it would no longer collect administrative and technical contact
information when it sells new domain name registrations. EPAG believes
collection of that particular data would violate the GDPR. ICANN's contract
with EPAG requires that information to be collected.

EPAG is one of over 2,500 registrars and registries that help ICANN maintain
the global information resource of the WHOIS system. ICANN is not seeking
to have its contracted parties violate the law. Put simply, EPAG's position
spotlights a disagreement with ICANNand others as to how the GDPR should be
interpreted.

On 30 May 2018, the Regional Court determined that it would not issue an
injunction against EPAG. In rejecting the injunctive relief, the Court
ruled that it would not require EPAG to collect the administrative and
technical data for new registrations. However, the Court did not indicate
in its ruling that collecting such data would be a violation of the GDPR.
Rather, the Court said that the collection of the domain name registrant
data should suffice in order to safeguard against misuse in connection with
the domain name (such as criminal activity, infringement, or security
problems).

The Court reasoned that because it is possible for a registrant to provide
the same data elements for the registrant as for the administrative and
technical contacts, ICANNdid not demonstrate that it is necessary to
collect additional data elements for those contacts. The Court also noted
that a registrant could consent and provide administrative and technical
contact data at its discretion.

On 13 June 2018, ICANN appealed the Regional Court's ruling to the Higher
Regional Court of Cologne, Germany, and again asked for an injunction that
would require EPAG to reinstate the collection of all WHOIS data required
under EPAG's Registrar Accreditation Agreement with ICANN.

ICANN appreciates and understands the dilemma of EPAG in trying to
interpret the GDPR rules against the WHOIS requirements, but if EPAG's
actions stand, those with legitimate purposes, including security-related
purposes, law enforcement, intellectual property rights holders, and other
legitimate users of that information may no longer be able to access full
WHOIS records.

In addition to the court proceedings, ICANN is continuing to pursue ongoing
discussions with the European Commission and the European Data Protection
Board to gain further clarification of the GDPR as it relates to the
integrity of WHOIS services.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ncsg.is/pipermail/ncsg-discuss/attachments/20180621/23cb7b34/attachment.htm>